CVE-2026-81759: CWE-862 Missing Authorization in Magepeople inc. WpEvently

This vulnerability, identified as CVE-2026-81759, is a broken access control issue (CWE-862) in the WpEvently plugin by Magepeople inc. Versions up to and including 5.5.0 are affected. The flaw allows users with some privileges (low privilege) to perform unauthorized actions, impacting the integrity and availability of the system. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no known exploit in the wild and no vendor-provided patch or remediation information at this time.

The vulnerability allows unauthorized modification or disruption of the affected system's operations by users with limited privileges. Confidentiality is not impacted, but integrity and availability may be compromised. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for unusual activity related to WpEvently plugin usage.